Darkmoon Review (2026): Pricing, Features & Honest Verdict

Darkmoon Review: The Quick Verdict

Darkmoon is an autonomous AI penetration testing platform that runs offensive security campaigns end to end. It uses 18 specialized agents and 80+ tools to find vulnerabilities and prove them with real exploits. Best for pentesters, security teams, and MSSPs. Price: free open-source core, Pro at €149/mo billed annually, managed engagements from €799. Rating: 7.5/10.

We found Darkmoon near the top of Product Hunt, billed as autonomous penetration testing, and the claim is bold enough to deserve scrutiny. AI security tools love to promise the moon and deliver a glorified scanner. Darkmoon is more interesting than that, because it leans on real payload execution and proof rather than a list of maybes.

What is Darkmoon?

Darkmoon is a security platform that orchestrates full offensive security campaigns on its own. You point it at a target, and a dispatcher coordinates a team of 18 specialized AI agents, each handling a slice of the work, across web apps, cloud, Active Directory, and Kubernetes. Under the agents sits a library of more than 80 integrated tools, the same kind of arsenal a human pentester would reach for. The output is a set of validated, evidence-backed findings rather than a noisy scan report.

It is built by ASC-IT, a team out of Toulouse, France, and the core is open source under the GPLv3 license, published on GitHub. That open-source posture matters in security, where teams want to read the code that is poking at their infrastructure. The product is aimed at people who do this for a living: professional pentesters, in-house security teams, and managed security service providers who need to run more engagements without hiring more humans. The pitch is not to replace the pentester but to give one person the reach of a small team.

What Are Darkmoon’s Key Features?

Multi-agent campaign dispatch

Darkmoon detects technology signals on a target and routes the campaign to the right specialist agents with cascading control. So a web app gets the web specialists, a Kubernetes cluster gets the container specialists, and the dispatcher keeps the whole thing coordinated. This mirrors how a real red team divides labor, and it is the part that makes the autonomous claim believable rather than marketing.

Real payload validation

This is the feature that separates Darkmoon from a vulnerability scanner. It tests for SQL injection, XSS, remote code execution, SSRF, JWT abuse, and more using actual exploits, not signature matching. The difference is everything. A scanner says this might be vulnerable. Darkmoon proves it by exploiting it, which kills the endless false positives that bury security teams.

Hardened, sealed runtime

The Pro build runs in an AES-256 sealed runtime with hardware-bound licensing, an integrity watchdog, and debugger detection. For a tool that is literally a weapon, locking down the runtime so it cannot be tampered with or quietly repurposed is a sensible piece of engineering. It also reflects that the team is thinking about the legal and operational risks of shipping an autonomous attacker.

Publication-ready reports

Findings come out as reports formatted for ISO 27001, HackerOne, and Bugcrowd, complete with CVSS 3.1 scoring and MITRE ATT&CK mapping. Anyone who has spent a weekend hand-formatting a pentest report knows how much time this saves. The work that follows the hacking is half the job, and Darkmoon takes a real bite out of it.

How Much Does Darkmoon Cost?

Darkmoon has a Community edition that is free, open source under GPLv3, and self-hosted. That is a genuine free tier, not a trial, and it is the right way to evaluate the engine before paying. The Pro plan is listed at €149 per month billed as €1,788 annually, and it adds the hardened runtime, a managed command center, and branded PDF reports. There is also a Custom tier for enterprises and MSSPs with multi-seat workspaces and a partner program.

Beyond the software, Darkmoon sells Pentest on Demand, a managed service at €799 per engagement where their experts run the platform for you and deliver a debriefed report, legal framework included. Compare that to a traditional manual pentest, which routinely runs from several thousand to tens of thousands of dollars, and the value is obvious. A platform like Pentera or Horizon3’s NodeZero costs far more and is sold on enterprise contracts. Darkmoon undercuts the category hard, especially for smaller shops.

Who is Darkmoon Best For?

Use Darkmoon if you are a professional pentester or a small security team that wants to run more engagements without scaling headcount. The real exploit validation and ready-made reports remove the two most tedious parts of the job. It is also a strong fit for MSSPs, who can resell engagements under their own brand, and for security-curious teams who want to start with the free open-source core and learn the engine before paying.

Skip Darkmoon if you do not have the security expertise to interpret and act on offensive findings responsibly, because an autonomous attacker in untrained hands is a liability, not an asset. Skip it too if your environment forbids running real exploits against production, since validation by exploitation is the whole point and a dealbreaker in some compliance regimes. And never run it against systems you do not own or have explicit permission to test. This is a tool with sharp edges.

Best Darkmoon Alternatives

Pentera is the enterprise automated security validation leader. It is polished, well supported, and trusted by large organizations, but it is sold on enterprise pricing that dwarfs Darkmoon. Choose it when budget is not the constraint and procurement wants a big-name vendor.

Horizon3.ai NodeZero is autonomous pentesting delivered as a cloud service, strong on continuous testing and clear remediation guidance. It is more hands-off than Darkmoon and priced accordingly, aimed at teams who want results without running the engine themselves.

Metasploit is the free, open-source classic for exploit development and manual penetration testing. It gives you total control but zero autonomy, so you supply all the time and skill. Use it when you want to drive every step yourself.

Final Verdict: Is Darkmoon Worth It?

Darkmoon is one of the more credible autonomous security tools we have looked at, precisely because it proves findings with real exploits instead of guessing. The multi-agent dispatch, the sealed runtime, and the report formats show a team that understands the full pentest workflow, not just the hacking. A free open-source core plus Pro at €149 a month makes serious offensive tooling accessible to shops that could never afford an enterprise platform.

The catch is that Darkmoon is powerful in a domain where power cuts both ways. This is not a tool you hand to a junior or run blindly against production. It rewards expertise and explicit authorization, and it punishes carelessness. For pentesters, security teams, and MSSPs who know what they are doing, Darkmoon is an easy recommendation and a genuine bargain. For everyone else, it is a reminder that some tools are only as safe as the hands holding them.